What is the CVSS score of CVE-2026-14932?

CVE-2026-14932 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-14932?

Yes, a patch is available for CVE-2026-14932. Update the affected software to the latest version immediately.

Telerik UI for AJAX CVE-2026-14932

EUVD-2026-47699 MEDIUM

Use of Hard-coded Cryptographic Key (CWE-321)

2026-07-22 ProgressSoftware

GHSA-wwqj-8cp4-vjmh

Information Disclosure Telerik Ui For Asp Net Ajax Progress Software

6.5

CVSS 3.1 · Vendor: ProgressSoftware

Severity by source

Vendor (ProgressSoftware) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

vuln.today AI

7.3 HIGH

Network-exposed handler with hardcoded key allows unauthenticated read and deletion; I:L assigned to capture file deletion impact omitted from the NVD-provided I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ProgressSoftware).

CVSS VectorVendor: ProgressSoftware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jul 22, 2026 - 16:18 EUVD

Analysis Generated

Jul 22, 2026 - 14:38 vuln.today

CVE Published

Jul 22, 2026 - 13:46 cve.org

MEDIUM 6.5

DescriptionCVE.org

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory.

AnalysisAI

Unauthenticated file read and deletion in Progress Telerik UI for ASP.NET AJAX (all versions prior to v2026.2.708) is made possible by a hardcoded cryptographic key (CWE-321) embedded in the obsolete RadChart component's ChartImage.axd HTTP handler. Remote attackers without any credentials can exploit this to read or delete image-extension files within the application directory, bypassing standard authentication controls entirely. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis, but the unauthenticated network-accessible attack vector warrants prompt patching for all affected deployments.

Technical ContextAI

The affected component is the ChartImage.axd HTTP handler registered by the RadChart charting control within Telerik UI for ASP.NET AJAX (CPE: cpe:2.3:a:progress_software:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*). CWE-321 (Use of Hard-coded Cryptographic Key) identifies the root cause: the handler relies on a static, embedded key to authenticate or authorize requests rather than deriving credentials dynamically or delegating to the ASP.NET authentication pipeline. Because the key is fixed, any party with knowledge of it - derivable from the binary or public disclosure - can forge valid requests. ASP.NET HTTP handlers (.axd endpoints) are registered directly in web.config and process requests outside of MVC or Web Forms page lifecycle controls, making them easy to overlook during security hardening. Progress Software itself describes RadChart as obsolete, meaning many deployments may retain the handler registration as dead code even after migrating away from the component, unintentionally preserving the attack surface.

RemediationAI

The primary fix is to upgrade to Telerik UI for ASP.NET AJAX v2026.2.708 or later, as confirmed by the Progress Software vendor advisory at https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-radchart-hardcoded-key-file-read-cve-2026-14932. For organizations unable to upgrade immediately, removing or commenting out the ChartImage.axd handler registration from web.config eliminates the attack surface entirely - note that this will break any residual RadChart rendering functionality if the component remains in use, but since RadChart is described as obsolete, the operational impact is likely minimal. As an additional compensating control, configuring IIS Request Filtering or a WAF rule to block HTTP requests targeting the ChartImage.axd path restricts external access without modifying application code; scope the rule specifically to ChartImage.axd to avoid disrupting other legitimate ASP.NET .axd handlers. Neither workaround substitutes for the vendor patch, which addresses the hardcoded key root cause.